Secure Boot Attack

BIOS Necromancy: Utilizing “Dead Code” for BIOS Attacks

During our work towards trying to help secure firmware, we have begun to discover a trend. There are situations where unused “dead …
Corey Kallenberg, Xeno Kovah
Cite Slides (PDF) Whitepaper (PDF) Conference Presentation Video
Thunderstrike 2: Sith Strike
In this work we teamed up with Trammell Hudson to improve upon his previous Thunderstrike proof of concept. Previously it required …
Trammell Hudson, Xeno Kovah, Corey Kallenberg
Cite Slides (PDF) Conference Presentation Video Demo Video 1 - Thunderstrike 2 'firmworm' propagation video Demo Video 2 - Bricking MacMini without a need for an exploit
How Many Million BIOSes Would you Like to Infect?
Because people don’t ever patch their BIOSes, it is extremely likely that the vast majority of systems in the wild are vulnerable to at …
Corey Kallenberg, Xeno Kovah
Cite Slides (PDF) Whitepaper (PDF) Demo Video 1 - Infecting ASUS Demo Video 2 - Infecting HP Demo Video 3 - Attacking TAILS Demo Video 4 - Bricking a Gigabyte motherboard with “DualUEFI” backup BIOS, which is supposed to prevent bricking
Betting BIOS Bugs Won’t Bite Y’er Butt?
Survey of some of the many BIOS level vulnerabilities that have come out in the past few years, for those who were not following the …
Xeno Kovah, Corey Kallenberg
Cite Slides (PDF) Conference Presentation Video
Extreme Privilege Escalation on Windows 8/UEFI Systems
Public disclosure of two vulnerabilities (VU#552286) that allow a ring 3 attacker to feed a UEFI system a fake BIOS update, cause a …
Corey Kallenberg, Xeno Kovah, John Butterworth, Sam Cornwell
Cite Slides (PDF) Whitepaper (PDF) Conference Presentation Video
SENTER Sandman: Using Intel TXT to Attack BIOSes
A description of how Intel TXT’s SMI suppression behavior can be used to subvert a BIOS protection mechanism. Also a discussion of on …
Xeno Kovah, Corey Kallenberg, John Butterworth, Sam Cornwell
Cite Slides (PDF) Whitepaper (PDF) Conference Presentation Video
Setup For Failure: Defeating Secure Boot
Disclosure of a vulnerability (VU#758382) with the “Setup” UEFI non-volatile variable on some systems. Manipulation of this variable …
Corey Kallenberg, Sam Cornwell, Xeno Kovah, John Butterworth
Cite Slides (Merged with Intel, PDF) Slides (Unmerged with Intel, PDF) Whitepaper (PDF) Conference Presentation Video
Copernicus 2: SENTER the Dragon!
Discussion of how a SMM MitM attacker (“Smite’em”) can subvert all software-based BIOS capture utilities (including our own …
Xeno Kovah, Corey Kallenberg, John Butterworth, Sam Cornwell
Cite Slides (PDF) Smiteem defeating BIOS reading tools demo video Copernicus 2 demo video